Analysis
-
max time kernel
148s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 05:10
Behavioral task
behavioral1
Sample
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
0471302a5727045c85e9f584f528b148
-
SHA1
b1f2c557df3595bdaa0d3e5a646f85e7f6ab370e
-
SHA256
4aae5086ec27b24590c37f5d07e365527a5f07b9819bb54052631f6d4757c431
-
SHA512
67c433cd708997e032c194634939a3024985bb4b7d6f1260bf1080800f51554a430f7195faf07cfb166e1ed8143caaaeec6ce24572703d2bac34c2216e6c9130
-
SSDEEP
24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZg:0UzeyQMS4DqodCnoe+iitjWwwc
Malware Config
Extracted
pony
http://don.service-master.eu/gate.php
-
payload_url
http://don.service-master.eu/shit.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 2 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
Processes:
explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 888 explorer.exe 4492 explorer.exe 3196 spoolsv.exe 3316 spoolsv.exe 3620 spoolsv.exe 2836 spoolsv.exe 2004 spoolsv.exe 680 spoolsv.exe 432 spoolsv.exe 868 spoolsv.exe 4464 spoolsv.exe 2092 spoolsv.exe 4608 spoolsv.exe 4072 spoolsv.exe 3872 spoolsv.exe 2060 spoolsv.exe 4100 spoolsv.exe 4636 spoolsv.exe 444 spoolsv.exe 1100 spoolsv.exe 4004 spoolsv.exe 4776 spoolsv.exe 2648 spoolsv.exe 4064 spoolsv.exe 4216 spoolsv.exe 1060 spoolsv.exe 1284 spoolsv.exe 4652 spoolsv.exe 3052 spoolsv.exe 2948 spoolsv.exe 1720 spoolsv.exe 888 spoolsv.exe 4372 spoolsv.exe 1836 explorer.exe 2332 spoolsv.exe 3584 spoolsv.exe 1240 spoolsv.exe 1952 spoolsv.exe 3672 spoolsv.exe 3480 explorer.exe 1760 spoolsv.exe 2936 spoolsv.exe 4428 spoolsv.exe 3144 spoolsv.exe 872 spoolsv.exe 844 spoolsv.exe 3468 explorer.exe 1056 spoolsv.exe 8 spoolsv.exe 5096 spoolsv.exe 3564 spoolsv.exe 3944 spoolsv.exe 824 explorer.exe 1668 spoolsv.exe 2744 spoolsv.exe 1740 spoolsv.exe 952 spoolsv.exe 2964 spoolsv.exe 1400 explorer.exe 3488 spoolsv.exe 1156 spoolsv.exe 700 spoolsv.exe 3200 spoolsv.exe 4420 spoolsv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 54 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exedescription pid process target process PID 1804 set thread context of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 888 set thread context of 4492 888 explorer.exe explorer.exe PID 3196 set thread context of 4372 3196 spoolsv.exe spoolsv.exe PID 3316 set thread context of 2332 3316 spoolsv.exe spoolsv.exe PID 3620 set thread context of 3584 3620 spoolsv.exe spoolsv.exe PID 2836 set thread context of 1240 2836 spoolsv.exe spoolsv.exe PID 2004 set thread context of 3672 2004 spoolsv.exe spoolsv.exe PID 680 set thread context of 1760 680 spoolsv.exe spoolsv.exe PID 432 set thread context of 2936 432 spoolsv.exe spoolsv.exe PID 868 set thread context of 4428 868 spoolsv.exe spoolsv.exe PID 4464 set thread context of 3144 4464 spoolsv.exe spoolsv.exe PID 2092 set thread context of 844 2092 spoolsv.exe spoolsv.exe PID 4608 set thread context of 1056 4608 spoolsv.exe spoolsv.exe PID 4072 set thread context of 8 4072 spoolsv.exe spoolsv.exe PID 3872 set thread context of 5096 3872 spoolsv.exe spoolsv.exe PID 2060 set thread context of 3944 2060 spoolsv.exe spoolsv.exe PID 4100 set thread context of 1668 4100 spoolsv.exe spoolsv.exe PID 4636 set thread context of 2744 4636 spoolsv.exe spoolsv.exe PID 444 set thread context of 1740 444 spoolsv.exe spoolsv.exe PID 1100 set thread context of 2964 1100 spoolsv.exe spoolsv.exe PID 4004 set thread context of 3488 4004 spoolsv.exe spoolsv.exe PID 4776 set thread context of 1156 4776 spoolsv.exe spoolsv.exe PID 2648 set thread context of 700 2648 spoolsv.exe spoolsv.exe PID 4064 set thread context of 4420 4064 spoolsv.exe spoolsv.exe PID 4216 set thread context of 3612 4216 spoolsv.exe spoolsv.exe PID 1060 set thread context of 4192 1060 spoolsv.exe spoolsv.exe PID 1284 set thread context of 468 1284 spoolsv.exe spoolsv.exe PID 4652 set thread context of 2744 4652 spoolsv.exe spoolsv.exe PID 3052 set thread context of 2252 3052 spoolsv.exe spoolsv.exe PID 2948 set thread context of 3572 2948 spoolsv.exe spoolsv.exe PID 1720 set thread context of 2208 1720 spoolsv.exe spoolsv.exe PID 888 set thread context of 4828 888 spoolsv.exe spoolsv.exe PID 1836 set thread context of 2960 1836 explorer.exe explorer.exe PID 1952 set thread context of 1544 1952 spoolsv.exe spoolsv.exe PID 3480 set thread context of 2384 3480 explorer.exe explorer.exe PID 872 set thread context of 3740 872 spoolsv.exe spoolsv.exe PID 3468 set thread context of 3880 3468 explorer.exe explorer.exe PID 824 set thread context of 1744 824 explorer.exe explorer.exe PID 3564 set thread context of 1868 3564 spoolsv.exe spoolsv.exe PID 1400 set thread context of 2376 1400 explorer.exe explorer.exe PID 952 set thread context of 4204 952 spoolsv.exe spoolsv.exe PID 2356 set thread context of 4968 2356 explorer.exe explorer.exe PID 3200 set thread context of 4796 3200 spoolsv.exe spoolsv.exe PID 4032 set thread context of 3056 4032 spoolsv.exe spoolsv.exe PID 628 set thread context of 540 628 explorer.exe explorer.exe PID 3784 set thread context of 4376 3784 spoolsv.exe spoolsv.exe PID 4976 set thread context of 4728 4976 spoolsv.exe spoolsv.exe PID 388 set thread context of 4324 388 spoolsv.exe spoolsv.exe PID 4988 set thread context of 2432 4988 explorer.exe explorer.exe PID 2680 set thread context of 3264 2680 spoolsv.exe spoolsv.exe PID 2676 set thread context of 3476 2676 spoolsv.exe spoolsv.exe PID 5096 set thread context of 1804 5096 spoolsv.exe spoolsv.exe PID 1132 set thread context of 4228 1132 explorer.exe explorer.exe PID 2588 set thread context of 4908 2588 spoolsv.exe spoolsv.exe -
Drops file in Windows directory 64 IoCs
Processes:
spoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe0471302a5727045c85e9f584f528b148_JaffaCakes118.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exeexplorer.exespoolsv.exeexplorer.exespoolsv.exespoolsv.exedescription ioc process File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\system\udsys.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini explorer.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe File opened for modification C:\Windows\Parameters.ini spoolsv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exepid process 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 4492 explorer.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exepid process 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4492 explorer.exe 4372 spoolsv.exe 4372 spoolsv.exe 2332 spoolsv.exe 2332 spoolsv.exe 3584 spoolsv.exe 3584 spoolsv.exe 1240 spoolsv.exe 1240 spoolsv.exe 3672 spoolsv.exe 3672 spoolsv.exe 1760 spoolsv.exe 1760 spoolsv.exe 2936 spoolsv.exe 2936 spoolsv.exe 4428 spoolsv.exe 4428 spoolsv.exe 3144 spoolsv.exe 3144 spoolsv.exe 844 spoolsv.exe 844 spoolsv.exe 1056 spoolsv.exe 8 spoolsv.exe 8 spoolsv.exe 1056 spoolsv.exe 5096 spoolsv.exe 5096 spoolsv.exe 3944 spoolsv.exe 3944 spoolsv.exe 1668 spoolsv.exe 1668 spoolsv.exe 2744 spoolsv.exe 2744 spoolsv.exe 1740 spoolsv.exe 1740 spoolsv.exe 2964 spoolsv.exe 2964 spoolsv.exe 3488 spoolsv.exe 3488 spoolsv.exe 1156 spoolsv.exe 1156 spoolsv.exe 700 spoolsv.exe 700 spoolsv.exe 4420 spoolsv.exe 4420 spoolsv.exe 3612 spoolsv.exe 3612 spoolsv.exe 4192 spoolsv.exe 4192 spoolsv.exe 468 spoolsv.exe 468 spoolsv.exe 2744 spoolsv.exe 2744 spoolsv.exe 2252 spoolsv.exe 2252 spoolsv.exe 3572 spoolsv.exe 3572 spoolsv.exe 2208 spoolsv.exe 2208 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0471302a5727045c85e9f584f528b148_JaffaCakes118.exe0471302a5727045c85e9f584f528b148_JaffaCakes118.exeexplorer.exeexplorer.exedescription pid process target process PID 1804 wrote to memory of 3916 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1804 wrote to memory of 3916 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe splwow64.exe PID 1804 wrote to memory of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1804 wrote to memory of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1804 wrote to memory of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1804 wrote to memory of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 1804 wrote to memory of 2620 1804 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe PID 2620 wrote to memory of 888 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2620 wrote to memory of 888 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 2620 wrote to memory of 888 2620 0471302a5727045c85e9f584f528b148_JaffaCakes118.exe explorer.exe PID 888 wrote to memory of 4492 888 explorer.exe explorer.exe PID 888 wrote to memory of 4492 888 explorer.exe explorer.exe PID 888 wrote to memory of 4492 888 explorer.exe explorer.exe PID 888 wrote to memory of 4492 888 explorer.exe explorer.exe PID 888 wrote to memory of 4492 888 explorer.exe explorer.exe PID 4492 wrote to memory of 3196 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3196 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3196 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3316 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3316 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3316 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3620 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3620 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3620 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2836 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2836 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2836 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2004 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2004 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2004 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 680 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 680 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 680 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 432 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 432 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 432 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 868 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 868 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 868 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4464 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4464 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4464 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2092 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2092 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2092 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4608 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4608 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4608 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4072 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4072 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4072 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3872 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3872 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 3872 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2060 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2060 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 2060 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4100 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4100 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4100 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4636 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4636 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 4636 4492 explorer.exe spoolsv.exe PID 4492 wrote to memory of 444 4492 explorer.exe spoolsv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0471302a5727045c85e9f584f528b148_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\explorer.exe"c:\windows\system\explorer.exe"8⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe7⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exe"c:\windows\system\spoolsv.exe"6⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
- Drops file in Windows directory
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Parameters.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\Parameters.iniFilesize
74B
MD56687785d6a31cdf9a5f80acb3abc459b
SHA11ddda26cc18189770eaaa4a9e78cc4abe4fe39c9
SHA2563b5ebe1c6d4d33c14e5f2ca735fc085759f47895ea90192999a22a035c7edc9b
SHA5125fe9429d64ee6fe0d3698cabb39757729b48d525500afa5f073d69f14f791c8aa2bc7ce0467d48d66fc58d894983391022c59035fa67703fefd309ec4a5d9962
-
C:\Windows\System\explorer.exeFilesize
2.2MB
MD596494085d5183ff2b1835cad9a035acd
SHA12c7f12625536b95ae6c64abaadea391b9a0f2821
SHA2563b8b618d2a352f9a30511ce8ab8e8a06f5222b74c84217b147305658e97e5e27
SHA5122588d5eeaded978e85ffc5b9e25ca8ac75fa1fbae50b557e56375bf1ff2a89ff4f9fcd2465dd28701ef51611c06f8f2bb0b78e3c0798ceaec8b5718066200229
-
C:\Windows\System\spoolsv.exeFilesize
2.2MB
MD54d87e71e933a2b8aedf1fa55f292f20b
SHA127bb2b7316fb6b026a9370f84fd6a076c2c0f784
SHA25692986bc5cc83820c2663b2c28d47e06071d72863ec260d99d9aea55b83e3ace1
SHA512605f11f6961534c88c4a265d2010551cb2284a6b4a336f450da0587712feb3e85906e700c2b1bd64691bea21545bd3f6f3549dfdd4798abf5e7a4c2daccb732c
-
memory/8-2339-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/432-1166-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/444-1792-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/468-2869-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/540-4637-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/680-1165-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/700-2697-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/844-2316-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/844-2470-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/868-1295-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/888-69-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/888-64-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1056-2330-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1056-2347-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1100-1793-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1240-1936-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1544-3608-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1544-3487-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1668-2497-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1740-2529-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1744-3930-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1744-3926-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1760-2128-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1804-32-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1804-5130-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1804-4964-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1804-0-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/1804-28-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/1804-26-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/1868-4051-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1868-3939-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2004-1164-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2060-1646-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2092-1474-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2208-3011-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2252-2988-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2332-1912-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2332-1908-0x0000000000440000-0x0000000000509000-memory.dmpFilesize
804KB
-
memory/2376-4207-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2376-4211-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2384-3496-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2432-4816-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2620-29-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2620-31-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2620-58-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2648-1923-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2744-3073-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2744-2925-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2744-2506-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2836-1008-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/2936-2138-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2960-3231-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2964-2742-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2964-2671-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3056-4758-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3056-4628-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3144-2167-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3196-1902-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3196-835-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3264-4824-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3316-1006-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3316-1914-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3476-4835-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3476-4832-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3488-2681-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3488-2678-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3572-3000-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3572-2997-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3584-1925-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3612-2850-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3620-1007-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3620-1919-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3672-2306-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3672-2120-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3740-3734-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3740-3851-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3872-1645-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/3880-3743-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/3944-2573-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4004-1900-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4064-1924-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4072-1476-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4100-1647-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4192-2858-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4192-2860-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4204-4311-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4228-5021-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4324-4806-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4324-4943-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4372-2067-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4372-1901-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4376-4717-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4420-2841-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4428-2148-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4464-1296-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4492-834-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4492-70-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4608-1475-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4636-1786-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4728-4726-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4776-1913-0x0000000000400000-0x00000000005D3000-memory.dmpFilesize
1.8MB
-
memory/4796-4608-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4828-3220-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4828-3355-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4908-5045-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/4968-4457-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5096-2355-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/5104-5056-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB